@fungi.computer/shiitake 0.0.0-stage → 0.1.0

package/dist/client.d.ts

@@ -0,0 +1,439 @@
+import type { SessionAttention } from "./session-attention.js";
+export { type SessionAttention } from "./session-attention.js";
+import type { SandboxFailureEvent } from "@fungi.computer/mycelium";
+import type { ModelPreference } from "./internal/model-preference.js";
+import type { Message } from "@fungi.computer/mule/effect";
+import type { ExtensionSlotV0, ExtensionStatusV0, Json } from "./extensions.js";
+import type { AbortCommand, BranchCommand, CompactCommand, OperatorCommand, TitleCommand, CancelCommand, ForkCommand, PromptCommand, PromptDelivery, SessionCommand } from "./internal/client-boundary.js";
+export { createShiitakeClient, type ShiitakeClientOptions, } from "./remote-client.js";
+export { bindAgentExtension, bindSessionExtension, type BoundAgentExtensionV0, type BoundCallV0, type BoundSessionExtensionV0, type ExtensionViewV0, type ScopedCommandsV0, } from "./extension-client.js";
+export { AcceptedSchema, parseAccepted, parseCancelResult, parseForkedSession, parseSessionFrame, parseSessionSnapshot, parseSessionSummaryPage, parseShiitakeError, } from "./client-wire.js";
+export type { AbortCommand, BranchCommand, CompactCommand, CancelCommand, ForkCommand, OperatorCommand, PromptCommand, PromptDelivery, SessionCommand, TitleCommand, } from "./internal/client-boundary.js";
+/** Semantic acknowledgement returned after one durable acceptance commit. */
+export type Accepted = Readonly<{
+    /** Indicates that the owner transaction committed. */
+    status: "accepted";
+    /** Owner-issued durable identity for the accepted work. */
+    commandId: string;
+}>;
+/**
+ * Cancelling found nothing left to cancel: the command is unknown to this
+ * Session, has already started (for an `onlyIfPending` cancel) or has already
+ * settled. It is an ordinary outcome, never an error.
+ */
+export type TooLate = Readonly<{
+    status: "too_late";
+    /** The command the caller tried to cancel. */
+    commandId: string;
+}>;
+/** Outcome of one cancel command. */
+export type CancelResult = Accepted | TooLate;
+/** Result returned after a fork commits a new cold-readable Session. */
+export type ForkedSession = Readonly<{
+    /** Identity of the newly created Session. */
+    sessionId: string;
+}>;
+/** Execute one retained type-discriminated Session command. */
+export type SessionCommandHandler = {
+    /** Accept a prompt or a compaction request as queued Session work. */
+    (input: PromptCommand | CompactCommand): Promise<Accepted>;
+    /** Cancel one accepted command, or report that it is too late. */
+    (input: CancelCommand): Promise<CancelResult>;
+    /** Abort the active run, select a lineage leaf, record an operator line, or set the title. */
+    (input: AbortCommand | BranchCommand | OperatorCommand | TitleCommand): Promise<undefined>;
+    /** Fork one complete entry lineage into a new Session. */
+    (input: ForkCommand): Promise<ForkedSession>;
+    /** Execute an already-decoded command union. */
+    (input: SessionCommand): Promise<Accepted | CancelResult | ForkedSession | undefined>;
+};
+/** Optional controls for the Promise-friendly text sender. */
+export type SendOptions = Readonly<{
+    /** Images retained alongside text in the accepted user message. */
+    images?: PromptCommand["images"];
+    /** Deliver at the next safe active-run boundary or after the current run. */
+    delivery?: PromptDelivery;
+    /** Private retry key, generated once when omitted; not the admitted command ID. */
+    requestId?: string;
+}>;
+/** One exact completed Pi message on the selected Session lineage. */
+export type SessionMessage = Readonly<{
+    /**
+     * Opaque metadata the in-process host attached; Shiitake never reads it.
+     * Decode it with the host's own schema.
+     */
+    meta?: Json;
+    /** Durable extension producer of this user message; absent for human prompts. */
+    origin?: Readonly<{
+        extensionId: string;
+        correlation: string | null;
+    }>;
+    /** Stable conversation identity; live progress completes under this value. */
+    id: string;
+    /** Woodstock order of the durable entry carrying this message. */
+    sequence: number;
+    /** Owner-issued accepted work correlation for this message, otherwise null. */
+    commandId: string | null;
+    /** Exact Pi message; Shiitake does not normalize provider replay metadata. */
+    value: Message;
+}>;
+/** Minimal constructor seam for runtimes without a global EventSource. */
+export type ShiitakeEventSourceConstructor = new (url: string) => Pick<EventTarget, "addEventListener"> & Pick<EventSource, "close"> & {
+    readonly readyState: number;
+};
+/** Durable outcome for one accepted work item on the selected Session lineage. */
+export type SessionTerminal = Readonly<{
+    /** Accepted work correlated through the command's Woodstock work_id. */
+    commandId: string;
+    /** Durable terminal outcome; this is the settlement authority. */
+    outcome: "completed" | "cancelled" | "failed" | "interrupted";
+    /** Woodstock order of the durable terminal entry. */
+    sequence: number;
+    /**
+     * The newest failure message the work recorded (an assistant error or a
+     * final retry error), exactly as stored; null when it recorded none.
+     */
+    diagnostic: string | null;
+    /**
+     * Opaque host metadata of the command that ended this work: the
+     * cancellation's, when a host-attributed cancel ended it. Shiitake never
+     * reads it.
+     */
+    meta?: Json;
+}>;
+/** Work occupying the executor partition that this queued command requires, without message or provider data. */
+export type AgentRunningWork = Readonly<{
+    kind: "session";
+    sessionId: string;
+    commandId: string;
+}> | Readonly<{
+    kind: "host";
+    lane: string;
+    jobId: string;
+}>;
+/**
+ * Raw facts about what a Session is doing now. Shiitake publishes facts only;
+ * a client decides what they mean (see Parakeet's `sessionViewState`).
+ */
+export type SessionActivity = Readonly<{
+    /**
+     * The Session's place in the Agent's queue. The command id is the accepted
+     * work's identity, the one a person may cancel with `onlyIfPending`.
+     */
+    queue: Readonly<{
+        state: "idle";
+    }> | Readonly<{
+        state: "queued";
+        commandId: string;
+        /** Live work ahead of this command; null means no executor work is active. */
+        runningWork: AgentRunningWork | null;
+    }> | Readonly<{
+        state: "running";
+        commandId: string;
+    }>;
+    /** A cancellation of the head work was requested but has not settled. */
+    cancellationRequested: boolean;
+    /** The running work's latest retry is waiting to be attempted, else null. */
+    retry: Readonly<{
+        attempt: number;
+        maxAttempts: number;
+        delayMs: number;
+        errorMessage: string;
+        /** When the retry was scheduled, in milliseconds since the epoch. */
+        scheduledAt: number;
+    }> | null;
+    /** Tool with an intent but no outcome yet for the running work, else null. */
+    activeTool: string | null;
+    /** Woodstock order of the newest model choice on the Session, else null. */
+    lastModelChoiceSequence: number | null;
+    /** A compaction is running now, started by this trigger; else null. */
+    compaction: Readonly<{
+        trigger: SessionCompactionTrigger;
+    }> | null;
+}>;
+/** Encoded extension slots keyed by extension identity; absent means unavailable. */
+export type SessionExtensionSlots = Readonly<Record<string, ExtensionSlotV0>>;
+/** Generic Session-scope extension commands. */
+export type SessionExtensionControls = Readonly<{
+    /** Call one Session-scope command with its encoded input; resolves the encoded output. */
+    call: (command: string, input: Json) => Promise<Json>;
+}>;
+/** Generic Agent-scope extension controls. */
+export type AgentExtensionControls = Readonly<{
+    /** Every rostered extension and whether it is running. */
+    list: () => Promise<readonly ExtensionStatusV0[]>;
+    /** Resume a stopped extension; it replays its settled backlog once. */
+    resume: (extensionId: string) => Promise<ExtensionStatusV0>;
+    /** Call one Agent-scope command with its encoded input; resolves the encoded output. */
+    call: (extensionId: string, command: string, input: Json) => Promise<Json>;
+}>;
+/** Process-local assistant progress; never a durable Session fact. */
+export type SessionProgress = Readonly<{
+    /** Stable message identity shared with the eventual completed Pi message. */
+    messageId: string;
+    revision: number;
+    text: string;
+    thinking: string;
+    textTruncated: boolean;
+    thinkingTruncated: boolean;
+}>;
+/** Accepted prompt waiting to enter the conversation, not a scheduling command. */
+export type SessionPendingPrompt = Readonly<{
+    /** Host-admitted metadata, retained opaquely before execution. */
+    meta?: SessionMessage["meta"];
+    /** Durable extension producer, absent for human prompts. */
+    origin?: SessionMessage["origin"];
+    /** Owner-issued identity of the waiting accepted work. */
+    commandId: string;
+    text: string;
+    images?: PromptCommand["images"];
+    delivery: PromptDelivery;
+}>;
+/** Bounded current admission view, in acceptance order rather than execution order. */
+export type SessionPendingPrompts = Readonly<{
+    /** Exact number of waiting admissions, including those outside this page. */
+    total: number;
+    prompts: readonly SessionPendingPrompt[];
+    /** Additional waiting admissions did not fit this view. */
+    hasMore: boolean;
+}>;
+/**
+ * Minimal full-history compaction boundary marker. `sequence` is the
+ * Woodstock order of the row this marker precedes (ties sort the marker
+ * first); `at` is when the compaction ran. The agent's model context is
+ * unaffected by this marker; it exists only for the client timeline.
+ */
+export type SessionCompactionMarker = Readonly<{
+    /** Stable identity of the durable compaction entry. */
+    id: string;
+    /** Woodstock order of the row this marker immediately precedes. */
+    sequence: number;
+    /** When the compaction ran, in milliseconds since the epoch. */
+    at: number;
+    /** Estimated context tokens the compaction started from. */
+    tokensBefore: number;
+    /** Estimated context tokens right after it; null for older compactions. */
+    tokensAfter: number | null;
+    /** What started it; null for compactions recorded before triggers were. */
+    trigger: SessionCompactionTrigger | null;
+}>;
+/** What started a compaction: the user, the context threshold, or an overflow. */
+export type SessionCompactionTrigger = "manual" | "threshold" | "overflow";
+/**
+ * A compaction that changed nothing: a manual request with nothing to
+ * summarize yet, or a compaction that failed. Automatic failures are never
+ * silent; each one is a notice at its own place in the timeline.
+ */
+export type SessionCompactionNotice = Readonly<{
+    /** Stable identity of the durable notice entry. */
+    id: string;
+    /** Woodstock order of the notice entry. */
+    sequence: number;
+    /** When it was recorded, in milliseconds since the epoch. */
+    at: number;
+    trigger: SessionCompactionTrigger;
+    result: "nothing_to_compact" | "failed";
+    /** A failure's bounded reason; null for "nothing to compact". */
+    diagnostic: string | null;
+}>;
+/**
+ * The Session's context use as compaction measures it, against the window of
+ * the model a run would select now; the window is null when that model
+ * reports none.
+ */
+export type SessionContext = Readonly<{
+    tokens: number;
+    window: number | null;
+}>;
+/** Bounded Session baseline at one opaque owner cursor. */
+export type SessionSnapshot = Readonly<{
+    /** Session represented by the snapshot. */
+    sessionId: string;
+    /** Opaque owner cursor at the snapshot boundary, or null when empty. */
+    cursor: string | null;
+    /** Whether an older durable entry exists before this bounded page. */
+    hasMore: boolean;
+    /**
+     * Opaque cursor naming the oldest row in this page; pass as `before` on
+     * `read()` to page further back. Null once no older history remains.
+     */
+    oldestCursor?: string | null;
+    /** Bounded exact Pi messages visible at the cursor. */
+    messages: readonly SessionMessage[];
+    /** Durable run_terminal facts visible at the cursor. */
+    terminals: readonly SessionTerminal[];
+    /** Every compaction boundary marker carried by this bounded page. */
+    compactions?: readonly SessionCompactionMarker[];
+    /** Every compaction notice carried by this bounded page. */
+    compactionNotices?: readonly SessionCompactionNotice[];
+    /** Operator diagnostics, excluded from the model conversation. */
+    sandboxFailures?: readonly SandboxFailureEvent[];
+    /** Current accepted prompts not yet entered or settled. */
+    pending: SessionPendingPrompts;
+    /** Raw facts about the Session's current activity. */
+    activity: SessionActivity;
+    /** Latest replaceable progress snapshot, if an assistant message is live. */
+    progress: SessionProgress | null;
+    /** Encoded projection slot of each extension granted one. */
+    extensions: SessionExtensionSlots;
+    /** Open requests for human attention from extensions. */
+    attention: readonly SessionAttention[];
+    /** Context use at the cursor; absent until the Session has context. */
+    context?: SessionContext;
+}>;
+/** One bounded replay or live frame. */
+export type SessionFrame = Readonly<{
+    /** Bounded Session-projection update discriminator. */
+    kind: "update";
+    /** Whether replay or a post-commit hint discovered the update. */
+    delivery: "replay" | "live";
+    /** Opaque cursor naming the last consumed private entry. */
+    cursor: string | null;
+    /** Current accepted prompts, replaced even when the history cursor is unchanged. */
+    pending: SessionPendingPrompts;
+    /** Newly visible exact Pi messages, possibly empty for status changes. */
+    messages: readonly SessionMessage[];
+    /** Durable run_terminal facts carried by this bounded update. */
+    terminals: readonly SessionTerminal[];
+    /** Compaction markers whose durable entry landed in this bounded update. */
+    compactions?: readonly SessionCompactionMarker[];
+    /** Compaction notices whose durable entry landed in this bounded update. */
+    compactionNotices?: readonly SessionCompactionNotice[];
+    /** Operator diagnostics, excluded from the model conversation. */
+    sandboxFailures?: readonly SandboxFailureEvent[];
+    /** Raw facts about the Session's activity at this cursor. */
+    activity: SessionActivity;
+    /** Encoded projection slot of each extension granted one. */
+    extensions: SessionExtensionSlots;
+    /** Open requests for human attention from extensions. */
+    attention: readonly SessionAttention[];
+    /** Context use at this cursor; absent until the Session has context. */
+    context?: SessionContext;
+}> | Readonly<{
+    /** Bounded process-local assistant progress. */
+    kind: "progress";
+    progress: SessionProgress;
+    /** Raw facts about the Session's activity read with this progress. */
+    activity: SessionActivity;
+}> | Readonly<{
+    /** History-reset frame discriminator. */
+    kind: "reset";
+    /** Stable neutral reason for unavailable continuity. */
+    reason: "history_unavailable";
+    /** Opaque cursor at the replacement baseline boundary. */
+    cursor: string | null;
+    /** Fresh owner-atomic replacement baseline. */
+    baseline: SessionSnapshot;
+}>;
+/** Strict-after replay request. */
+export type SubscribeOptions = Readonly<{
+    /** Explicit operator inspection; never enable for a model capability. */
+    includeSandboxFailures?: boolean;
+    /** Resume strictly after this opaque cursor when present. */
+    after?: string;
+}>;
+/** Bounded baseline request. */
+export type ReadOptions = Readonly<{
+    /** Explicit operator inspection; ordinary reads omit private diagnostics. */
+    includeSandboxFailures?: boolean;
+    /** Maximum number of messages to include in the bounded baseline. */
+    limit?: number;
+    /**
+     * Page strictly before this opaque cursor (from a snapshot's
+     * `oldestCursor`) instead of reading the latest page.
+     */
+    before?: string;
+}>;
+/** Race-safe observation request. */
+export type WatchOptions = ReadOptions;
+/** Race-safe baseline plus live changes resource. */
+export type SessionWatch = Readonly<{
+    /** Race-safe baseline observed before live changes. */
+    snapshot: SessionSnapshot;
+    /** Live frames after the baseline boundary. */
+    changes: AsyncIterable<SessionFrame>;
+    /** Release the live observation resources. */
+    close: () => Promise<void>;
+}>;
+/** Addressable Session interface. Addressing itself performs no I/O. */
+export type ShiitakeSession = Readonly<{
+    /** Stable logical address used to share observation across client mounts. */
+    address: string;
+    /** Execute one retained type-discriminated Session command. */
+    command: SessionCommandHandler;
+    /** Cancel the running turn and all queued prompts, retaining their text. */
+    abort: () => Promise<void>;
+    /** Send text with an optional private caller idempotency identity. */
+    send: (text: string, options?: SendOptions) => Promise<Accepted>;
+    /** Cancel exactly the accepted work named by its owner-issued identity. */
+    cancel: (input: Readonly<{
+        commandId: string;
+        onlyIfPending?: boolean;
+    }>) => Promise<CancelResult>;
+    /** Address one rostered extension's Session-scope commands. */
+    extension: (extensionId: string) => SessionExtensionControls;
+    /** Lineage-local request for later runs; null inherits the Agent default. */
+    modelPreference: Readonly<{
+        /** Read the saved override; null selects the Agent default. */
+        read: () => Promise<ModelPreference | null>;
+        /** Save an override for later acquisition without starting a provider call. */
+        set: (preference: ModelPreference | null) => Promise<void>;
+    }>;
+    /** Read a bounded durable baseline. */
+    read: (input?: ReadOptions) => Promise<SessionSnapshot>;
+    /** Subscribe to strict-after replay and live frames. */
+    subscribe: (input: SubscribeOptions) => AsyncIterable<SessionFrame>;
+    /** Open a race-safe baseline plus live changes resource. */
+    watch: (input?: WatchOptions) => Promise<SessionWatch>;
+}>;
+/**
+ * Owner-decided inbox state, from Watchdog's queue head and latest outcome.
+ * `running` covers queued, thinking, streaming, retrying and cancelling;
+ * `errored` covers failed, interrupted and `outcome_unknown`; `done` covers
+ * completed, cancelled and never run. Any open extension attention produces
+ * `needs_you`, taking priority over live and settled work.
+ */
+export type SessionInboxState = "needs_you" | "running" | "errored" | "done";
+/** Read-only saved conversation projection; opening does not update recency. */
+export type SessionSummary = Readonly<{
+    createdAt: number;
+    /** Latest durable conversation change or run transition. */
+    lastActivityAt: number;
+    /** When the latest run settled; absent until one settles. */
+    settledAt?: number;
+    title: string;
+    state: SessionInboxState;
+}>;
+/** One listed conversation, or a saved Session its owner could not read. */
+export type SessionSummaryRow = (SessionSummary & Readonly<{
+    sessionId: string;
+}>) | Readonly<{
+    sessionId: string;
+    state: "unavailable";
+}>;
+/**
+ * One owner-bounded page: `needs_you`, then `running`, then settled rows, each
+ * newest activity first. `next` is an opaque owner cursor.
+ */
+export type SessionSummaryPage = Readonly<{
+    sessions: readonly SessionSummaryRow[];
+    next: string | undefined;
+}>;
+/** Constructed durable harness. */
+export type ShiitakeAgent = Readonly<{
+    /** Return the same address when creation is retried with this request ID. */
+    createSession: (requestId: string) => Promise<string>;
+    /**
+     * Permanently delete one idle Session and its history; resolves false when
+     * it does not exist. A Session with queued or running work is a conflict.
+     */
+    deleteSession: (sessionId: string) => Promise<boolean>;
+    /** Enumerate existing conversations without creating or touching them. */
+    listSessions: (after?: string) => Promise<SessionSummaryPage>;
+    /** List, resume and call rostered extensions. */
+    extensions: AgentExtensionControls;
+    /** Address a session without performing I/O. */
+    session: (sessionId: string) => ShiitakeSession;
+    /** Close the owned harness and release resources. */
+    close: () => Promise<void>;
+}>;
+export type { ModelPreference } from "./internal/model-preference.js";

package/dist/client.js

@@ -0,0 +1,4 @@
+export {} from "./session-attention.js";
+export { createShiitakeClient, } from "./remote-client.js";
+export { bindAgentExtension, bindSessionExtension, } from "./extension-client.js";
+export { AcceptedSchema, parseAccepted, parseCancelResult, parseForkedSession, parseSessionFrame, parseSessionSnapshot, parseSessionSummaryPage, parseShiitakeError, } from "./client-wire.js";

package/dist/cloudflare.d.ts

@@ -0,0 +1,220 @@
+import type { CommandSettlement } from "./internal/contracts.js";
+import type { BirdDogMail } from "@fungi.computer/bird-dog";
+import type { VerifiedAgentReply } from "./internal/woodstock/index.js";
+import type { BirdDogEffect } from "@fungi.computer/bird-dog/effect";
+import type { Accepted } from "./client.js";
+import type { HostMetaOptions } from "./internal/host-meta.js";
+import { DurableObject } from "cloudflare:workers";
+import type { CapabilitySource, ModuleRegistration, Sandbox } from "@fungi.computer/mycelium";
+import { type WatchdogExecutionDecision, type WatchdogReadResult, type WatchdogRunningJob, type WatchdogTransactionalProjection, type WatchdogTickResult } from "@fungi.computer/watchdog";
+import type { ExtensionRosterV0, Json } from "./extensions.js";
+import { type ShiitakeHttpEnv } from "./http-routes.js";
+import { Hono } from "hono";
+import type { InstructionSource, ModelSource, GrantsDelivery, GrantsDeliveryResult, ShiitakeOwnerAgent, SqliteOwner, StorageBudget, CompactionOptions, ToolAccess } from "./internal/contracts.js";
+import { type SessionInboxChanges } from "./internal/woodstock/index.js";
+import { type BrowserHost } from "./internal/browser-sessions.js";
+export type { SessionInboxChanges } from "./internal/woodstock/index.js";
+export type { BrowserHost } from "./internal/browser-sessions.js";
+export type { GrantsDelivery, GrantsDeliveryResult, ShiitakeOwnerAgent, ToolAccess, } from "./internal/contracts.js";
+/**
+ * Deliver one Session's grants into a Cloudflare owner's own storage,
+ * synchronously, whether or not its runtime is open; the very next tool call
+ * reads it. A plain function, not a Durable Object method, so no other
+ * Durable Object can call it over RPC: only code running inside the owner,
+ * holding its storage, delivers grants.
+ */
+export declare function deliverSessionGrantsToStorage(storage: SqliteOwner, sessionId: string, delivery: GrantsDelivery): GrantsDeliveryResult;
+/** Native Durable Object capabilities used by the Cloudflare adapter. */
+export type CloudflareShiitakeState = Readonly<{
+    /** Native owner-local SQLite used by Woodstock and Watchdog. */
+    storage: SqliteOwner & Pick<DurableObjectStorage, "getAlarm" | "setAlarm" | "deleteAlarm"> & {
+        /** Commit an asynchronous owner mutation through native storage. */
+        transaction<A>(body: () => Promise<A>): Promise<A>;
+    };
+    /** Extend the Durable Object event lifetime through runtime reconciliation. */
+    waitUntil: (task: Promise<unknown>) => void;
+}>;
+/** Non-empty Mycelium capabilities supplied by a Cloudflare host. */
+export type CloudflareShiitakeTools = Readonly<{
+    modules?: readonly ModuleRegistration[];
+    sources?: readonly CapabilitySource[];
+    sandbox: Sandbox;
+    /**
+     * The Agent-wide access defaults for every tool of the run, as data. A
+     * Session's grants the host delivered with the owner's `grants.deliver` override
+     * the default key by key. Mycelium reads them at every call; Shiitake never
+     * interprets them. Absent is full access.
+     */
+    access?: ToolAccess;
+}>;
+/**
+ * Durable host work that shares Shiitake's one native alarm, such as a
+ * host-owned delivery outbox. Shiitake never interprets it.
+ */
+export type CloudflareHostWork = Readonly<{
+    /** Read synchronously inside the alarm transaction. */
+    pending: () => Readonly<{
+        due: boolean;
+        nextWakeAt: number | null;
+    }>;
+    /** One bounded pass, requested independently on every durable wake. */
+    run: () => Promise<void>;
+}>;
+/** Host jobs use a separate slot in Shiitake's one Watchdog and native alarm. */
+export type CloudflareHostJobs = Readonly<{
+    lane: string;
+    /** Open the host executor on the shared transactional job store. */
+    open: (runtime: Readonly<{
+        transactional: WatchdogTransactionalProjection;
+        readJob: (jobId: string) => Promise<WatchdogReadResult>;
+        /** Execute one job in the construction-time host partition. */
+        tickConcurrent: () => Promise<WatchdogTickResult>;
+    }>) => Readonly<{
+        /** Execute one job claimed for this host lane. */
+        execute: (job: WatchdogRunningJob) => Promise<WatchdogExecutionDecision>;
+    }>;
+}>;
+/** ACP's maintained transport, supplied by the host without a package cycle. */
+export type CloudflareShiitakeAcpServer = Readonly<{
+    /**
+     * Forward an authenticated ACP HTTP request to the maintained SDK server,
+     * with the metadata the host's middleware attached to it.
+     */
+    handleRequest: (request: Request, meta: Json | undefined) => Promise<Response>;
+}>;
+/** Cloudflare host inputs; the model owner resolves one frozen run selection. */
+export type CloudflareShiitakeOptions = Readonly<{
+    /**
+     * The schema of the opaque metadata this host attaches to prompts and
+     * operator lines. Shiitake checks, stores and returns it; it never reads it.
+     */
+    meta?: HostMetaOptions;
+    model: ModelSource;
+    instructions: InstructionSource;
+    tools?: readonly [] | CloudflareShiitakeTools;
+    /**
+     * Disk budget for this Durable Object's SQLite, measured with
+     * `ctx.storage.sql.databaseSize`; absent never refuses for storage pressure.
+     */
+    storageBudget?: StorageBudget;
+    /** Compaction budgets; absent uses Pi's defaults for every model. */
+    compaction?: CompactionOptions;
+    /** The host's explicit extension roster and grants; there is no default. */
+    extensions: ExtensionRosterV0;
+    /**
+     * Owner startup work, such as extension commands or storing Session grants,
+     * finishes before any durable run or host work is recovered.
+     */
+    initialize?: (agent: ShiitakeOwnerAgent) => Promise<void>;
+    /** Independent host work kept alive by the same alarm; absent means none. */
+    hostWork?: readonly CloudflareHostWork[];
+    /** Optional host lane in the same Watchdog; use hostWork for due retries. */
+    hostJobs?: CloudflareHostJobs;
+    /** Host-owned addressed mail and settlement replies; absent disables mail. */
+    mailRoom?: BirdDogEffect;
+    /** Session-scoped browser tools and maintained HTTP transport; absent disables it. */
+    browser?: (sessionId: string) => BrowserHost;
+    /**
+     * Lazily open ACP over the owned in-process handle. The host authorizes
+     * ingress and supplies its context policy. ACP borrows this handle: closing
+     * a protocol connection must release its watches, never close the runtime.
+     * Absent means `/acp` is unavailable.
+     */
+    acp?: (agent: ShiitakeOwnerAgent) => Promise<CloudflareShiitakeAcpServer>;
+}>;
+/** Cloudflare host lifecycle; alarm forwarding stays outside the neutral client. */
+export type CloudflareShiitake = ShiitakeOwnerAgent & Readonly<{
+    /** Exact settled command facts, outside the neutral Session transport. */
+    readSettlement: (sessionId: string, commandId: string) => Promise<CommandSettlement | undefined>;
+    /**
+     * Admit host-authorized mail, preserving its parent address and opaque
+     * metadata. `reply` is the host's authentication of a delegated reply.
+     */
+    acceptMail: (mail: BirdDogMail, meta?: Json, reply?: VerifiedAgentReply) => Promise<Accepted>;
+    /** Deliver the native owner alarm to the bound runtime. */
+    alarm: () => Promise<void>;
+    /** Snapshot actual live executors, independent of instruction or browser leases. */
+    activeSessions: () => Promise<readonly string[]>;
+    /** Abort each currently executing Session through its ordinary cancellation door. */
+    abortActive: () => Promise<void>;
+    /** Session-scoped browser transport and teardown, owned by this host. */
+    browser: Readonly<{
+        /** Serve a Session browser request after host ingress authorization. */
+        fetch: (request: Request) => Promise<Response>;
+        /** Cancel browser connections and release the current ephemeral hosts. */
+        clear: () => Promise<void>;
+    }>;
+}>;
+/** Construct Shiitake over one Durable Object's SQLite and lifetime. */
+export declare function makeCloudflareShiitake(state: CloudflareShiitakeState, options: CloudflareShiitakeOptions): Promise<CloudflareShiitake>;
+/** Owns runtime opening, HTTP/ACP transport, inbox observation and alarm recovery. */
+export declare abstract class ShiitakeOwner<Env, State extends CloudflareShiitakeState = CloudflareShiitakeState> {
+    protected readonly ctx: State;
+    protected readonly env: Env;
+    constructor(ctx: State, env: Env);
+    private agentPromise;
+    private openAcp;
+    private acpServer;
+    /** Consecutive native alarm failures; reset on the next successful alarm. */
+    private alarmFailures;
+    private readonly routes;
+    /** Supply this agent's model, instructions, and optional capabilities. */
+    protected abstract shiitakeOptions(): CloudflareShiitakeOptions;
+    /** Borrow this owner's runtime directly; only the host owns its lifetime. */
+    shiitake(): Promise<CloudflareShiitake>;
+    /** Stop live execution without constructing a cold owner's runtime. */
+    abortActiveSessions(): Promise<void>;
+    /** Close owned resources before storage erasure; a cold owner has none. */
+    closeShiitake(): Promise<void>;
+    /** Indexed owner-local existence check; corrupt stored Sessions remain unavailable. */
+    protected hasStoredSession(sessionId: string): Promise<boolean>;
+    /** Bounded strict-after read of this Agent's changed inbox rows. */
+    readInboxChanges(after: number, limit: number): Promise<SessionInboxChanges>;
+    /** Latest inbox revision; read only after the owner has opened. */
+    readInboxRevision(): number;
+    /** Prune deletion deltas after every current member inbox has acknowledged them. */
+    pruneInboxTombstones(through: number): void;
+    /** Persist a wake and run one reconciliation pass, including host work. */
+    wakeRuntime(): Promise<void>;
+    /**
+     * Native alarms reconstruct the owner without an incoming user request.
+     * A construction or wake failure must not strand the claimed work on
+     * platform alarm retries: it is caught, logged, and explicitly re-armed
+     * with bounded backoff instead.
+     */
+    alarm(): Promise<void>;
+    /** Serve Shiitake's complete transport without subclass routing. */
+    private app;
+    /**
+     * Shiitake's whole HTTP surface (Session routes, browser and ACP) as one
+     * Hono app. A host mounts it behind its own middleware, which alone may
+     * set the `shiitakeMeta` variable.
+     */
+    protected shiitakeApp(): Hono<ShiitakeHttpEnv>;
+    /** Serve one request through Shiitake's whole HTTP surface. */
+    fetch(request: Request): Promise<Response>;
+}
+/** Native Cloudflare entry points; all runtime lifetime belongs to the owner. */
+export declare abstract class ShiitakeDO<Env> extends DurableObject<Env> {
+    #private;
+    protected abstract shiitakeOptions(): CloudflareShiitakeOptions;
+    protected runtimeOwner(): ShiitakeOwner<Env>;
+    protected shiitake(): Promise<CloudflareShiitake>;
+    protected abortActiveSessions(): Promise<void>;
+    protected closeShiitake(): Promise<void>;
+    protected readInboxChanges(after: number, limit: number): Promise<Readonly<{
+        rows: readonly (import("./client.js").SessionSummaryRow | Readonly<{
+            sessionId: string;
+            deleted: true;
+        }>)[];
+        through: number;
+        latest: number;
+    }>>;
+    protected readInboxRevision(): number;
+    protected pruneInboxTombstones(through: number): void;
+    protected wakeRuntime(): Promise<void>;
+    /** Reconcile due runtime and host work through the owner. */
+    alarm(): Promise<void>;
+    /** Route an authenticated client request through the owner. */
+    fetch(request: Request): Promise<Response>;
+}